[Gnso-epdp-team] Notes and action items from EPDP Team Phase 2 Meeting #11 - 1 August 2019 - ALAC Online buyers Use Case

[Mueller, Milton L]

Tara:
Responses inline below:


  1.  The ICANN Board resolved in May to have the ePDP “determine and resolve the Legal vs. Natural issue in Phase 2."   https://www.icann.org/resources/board-material/resolutions-2019-05-15-en#1.b  Because the issue is not decided.
 Not quite correct. The Board noted that EPDP’s own Recommendation said that we would resolve the issue in Phase 2. The board did not tell us to do so. The resolution also notes the “Potential liability of a registered name holder's incorrect self-identification of a natural or legal person, which ultimately results in public display of personal data.” This concern was one of several that motivated our reluctance to attempt differentiation.

  1.  The EWG recommended a differentiation solution -- that registrants be required to identify as a Registrant Type, with Legal Person and Natural Person among the options.  It also required that a mandatory Business PBC be published for “Registrants that self-identify as Legal Persons engaged in commercial activity"  (pages 42-44 of final report).
This option _was_ discussed and discarded in Phase 1. It was noted that to the vast majority of ordinary people the distinction between legal and natural has no meaning, and that there would be liability consequences if there were incorrect identification (see above). And besides, the recommendation of the EWG was made prior to GDPR and has no bearing on EPDP.

  1.  ICANN’s Procedure for Handling WHOIS Conflicts with Privacy Law was reviewed by the GNSO and revised in mid-2017.  A goal of the Procedure was “to resolve the problem in a manner that preserves the ability of the registrar/registry to comply with its [current] contractual WHOIS obligations to the greatest extent possible”.  So -- to publish as much data as possible as allowed by law.
 Now you are way off base. Contractual Whois obligations in 2017 were not compliant with GDPR. The Conflicts with Privacy Law procedure is completely irrelevant to our proceedings.

  1.  Under that Procedure, about the only precedent was the .TEL case, which addressed concerns raised by UK privacy law. In that case, the WHOIS service was made to differentiate between natural and legal persons.  Some public WHOIS data was limited for natural persons who had elected to withhold their personal information from disclosure by the WHOIS service, records for Legal Persons had to return full and complete WHOIS data (including applicable personal data), and Legal Persons were not permitted to opt out of disclosing such information. The GDPR is definitely a different law and may yield a different policy.  But the .TEL case did show that it’s possible to tell the difference between a natural person’s data and a legal person’s data, and to control where that data appears.
 Same comment as above.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mm.icann.org/pipermail/gnso-epdp-team/attachments/20190819/97aeda3c/attachment.html>